Provisional Measure 1,124/22 published this past June 14, 2022, transformed the Brazilian Data Protection Authority into a special nature entity. The Measure is binding and will become legally effective immediately upon publication. As a result, the Authority will receive full administrative and budgetary autonomy, previously limited to just technical and decision-making. To become law, the Measure must be approved by the National Congress within 60 days, subject to an additional 60-day extension.

With this change, the Authority’s nature will no longer be deemed temporary, as originally provided in art. 55-A, §1 of the Brazilian Data Protection Law (Law No. 13,709/18) . Instead, it will exercise comprehensive technical, decision-making, and budgetary autonomy.

With no increase in cost, the Measure also creates a position for the Authority’s Director, while allocating current servers to the Authority. At the same time, the Authority’s organizational structure and powers established by the Law will be maintained.

The challenge now remains to convince the Brazilian Congress to grant the Measure urgent and relevant status, both prerequisites for provisional measures. Despite the Law’s declaration of the Authority’s temporary nature, the latter has operated without interruption since December 2018.

Finally, given its intent to join the Organization for Economic Cooperation and Development (OECD), Brazil must change its national data protection regulatory system by incorporating an autonomous regulatory entity. The Authority’s recently expanded budgetary, administrative, and technical autonomy represents an important step towards that objective.